Configuring Standard and Formula Score Attributes

Note:

Standard and formula score attributes are currently available for customers with Advanced and Enterprise licenses.

You can configure standard and formula type score attributes in the Attribute Manager for risks and inventories. These attributes allow users to leverage their own levels, scores, and scoring ranges to provide greater flexibility for custom risk scoring. These attributes allow users to manage and customize risks as well as provide the benefits listed below:

Modify per Custom Requirements

As a user, you will have flexibility in defining and configuring risk levels that your organization is familiar with using color schemes that are universally understood within your risk management teams and assigning scores to each level.

Make Subjective Content more Quantifiable

Risks are often hard to quantify based on out of the box templates. With the new risk score attribute, you can leverage various attributes to decide how risks are weighted and quantified as per the set score levels.

Reduce Manual Effort

Maximize our formula calculations to allow you to rescore all existing risks based on custom calculations or other quantification techniques automatically.

Flexible and Adaptable

If there is a change in business requirements, you can edit the formula or risk scoring type by editing attribute details.

For more information on creating attributes, see Adding, Editing, and Deactivating Attributes.

To configure a standard score attribute

The standard score type allows you to configure risk levels, scores, and colors. You have the ability to create as many levels and scores as needed.

  1. On the IT & Security Risk Management menu, select Attribute Manager.

    The Attribute Manager screen appears.

  2. Click the View button on the Risk Attributes or any Inventory Attributes tile.
  3. Click the Add Attribute button.

    The Add Attribute modal appears.

  4. Complete the fields, for more information, see Add Standard Score Attribute Modal Reference.
  5. Click the Edit button.


    The Edit Levels modal appears.

  6. Configure the level colors, scores, names, and add or remove levels as needed and click the Continue button.
    Note:

    You can configure the Level Color by providing a hex code or by clicking the color and selecting from the color picker.

  7. Click the Save button.

Add Standard Score Attribute Modal Reference



Field
Description
Name

Enter a name of the attribute.

Level Name (Reporting Only)

Enter a level name. This field helps support filtering capabilities in the Reporting module when creating a report using the Custom Risk Score Levels - Risk and Custom Score Level - Risk attributes.

Description

Enter a brief description of the attribute.

Response Type

Select Score to configure a risk score attribute.

Score Type

Select Standard.

Link Category

Enable this setting to select the risk categories that you would like to link to the attribute.

Note:

This setting is only available for risk attributes.

To edit levels of an existing standard risk score attribute

  1. Open the existing standard score attribute you would like to edit.

    The Attribute Details screen appears.

  2. Click the Edit Levels button.
  3. Configure the level colors, scores, names, and add or remove levels as needed.
  4. Click the Save button.

    The Rescore modal appears.

  5. Click the Rescore & Save button to rescore the existing risks and inventories and all related objects with the updated configuration.

    Click the Don't Rescore & Save button to only score newly created risks and inventories with the updated configuration.

To configure a formula score attribute

The formula score type allows you to configure how the risk or inventory should be scored by relating other risk attributes, inventory attributes, and control details.

  1. On the IT & Security Risk Management menu, select Attribute Manager.

    The Attribute Manager screen appears.

  2. Click the View button on the Risk Attributes or any Inventory Attributes tile.
  3. Click the Add Attribute button.

    The Add Attribute modal appears.

  4. Complete the fields, for more information, see Add Formula Score Attribute Modal Reference.
  5. Click the Edit button.

    The Edit Formula and Levels modal appears.

  6. Complete the fields, for more information, see Edit Formula and Levels Modal Reference.
  7. Click the Test Validation button to ensure the formula is valid.
    Note:

    If the Invalid Formula Syntax error message appears, please correct the formula. You will not be able to save the update until the formula is validated.

  8. Click the Continue button.
  9. Click the Save button.

Add Formula Score Attribute Modal Reference



Field
Description
Name

Enter a name of the attribute.

Level Name (Reporting Only)

Enter a level name. This field helps support filtering capabilities in the Reporting module when creating a report using the Custom Risk Score Levels - Risk and Custom Score Level - Risk attributes.

Description

Enter a brief description of the attribute.

Response Type

Select Score to configure a risk score attribute.

Score Type

Select Formula.

Link Category

Enable this setting to select the risk categories that you would like to link to the attribute.

Note:

This setting is only available for risk attributes.

Rescore Existing Risks

Enable this setting to rescore existing risks and inventories with the new formula. Disable this setting to only calculate future risks and inventories.

Note:

If this setting is not enabled, the risk or inventory will update the next time you make changes to it. For example, updating risk fields or treatment stage.

Edit Formula and Levels Modal Reference



Tip:

You can use multiple attributes in the mathematical formula. To add multiple attributes to your formula, separate the attribute values with commas and place the attribute values inside the parenthesis of the formula.

The standard characters needed for mathematical functions include:

  • Multiplication: *

  • Addition: +

  • Subtraction: -

  • Division: /

Field
Description
Formula Bar

Use this bar to build the formula using functions and existing risk attributes.

Function

Select from the default functions provided to build the formula.

Attributes

Select attributes in the list provided to build the formula.

Risk formula score attributes

do not support cross-object logic with inventory types, but can reference related controls and issues.

Inventory formula score attributes

support cross-object logic with related inventories (e.g., Assets, Vendors). To ensure formulas are evaluated and calculated correctly between cross-domain objects, the objects must be related to one another. You can manually relate the objects using theRelatedtab of the correspondingInventory Detailsscreen.

Example: The custom formula = MAX (Vendor Attribute, Processing Activity Attribute).

For this formula to be evaluated on the inventory record, the corresponding vendor and processing activity must be related. This can be validated in the Related tab of either Inventory Details screen.

Level Color

Configure the color of the risk level.

Note:

You can configure the Level Color by providing a hex code or by clicking the color and selecting from the color picker.

Score

Configure the score of the risk level.

Tip:

You can assign negative numerical values to risk score levels when configuring formula score attributes.

Level Name

Enter a brief name for the level.

To edit formulas of an existing formula score attribute

  1. Open the existing formula score attribute you would like to edit.

    The Attribute Details screen appears.

  2. Click the Edit Formula button.
  3. Configure the formula, level colors, scores, names, and add or remove levels as needed.
    Note:

    You must click the Test Validation button if you update the formula.

  4. Click the Save Formula button.

    The Rescore modal appears.

  5. Click the Rescore & Save button to rescore the existing risks or inventories and all related objects with the updated configuration.

    Click the Don't Rescore & Save button to only score newly created risks and inventories with the updated configuration.